EP3839779A1 - Système électronique et procédés pour une activation dynamique de contre-mesures - Google Patents

Système électronique et procédés pour une activation dynamique de contre-mesures Download PDF

Info

Publication number
EP3839779A1
EP3839779A1 EP19306680.0A EP19306680A EP3839779A1 EP 3839779 A1 EP3839779 A1 EP 3839779A1 EP 19306680 A EP19306680 A EP 19306680A EP 3839779 A1 EP3839779 A1 EP 3839779A1
Authority
EP
European Patent Office
Prior art keywords
function
security
execution
electronic system
start address
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Withdrawn
Application number
EP19306680.0A
Other languages
German (de)
English (en)
Inventor
Vincent DUMAS
André Sintzoff
Sylvain Charbonnier
Jean Roch Coulon
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Thales DIS France SAS
Original Assignee
Thales DIS France SA
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Thales DIS France SA filed Critical Thales DIS France SA
Priority to EP19306680.0A priority Critical patent/EP3839779A1/fr
Priority to EP20848856.9A priority patent/EP4078418A1/fr
Priority to US17/783,688 priority patent/US20230080096A1/en
Priority to PCT/FR2020/052559 priority patent/WO2021123684A1/fr
Publication of EP3839779A1 publication Critical patent/EP3839779A1/fr
Withdrawn legal-status Critical Current

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/55—Detecting local intrusion or implementing counter-measures
    • G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F2221/00—Indexing scheme relating to security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F2221/03—Indexing scheme relating to G06F21/50, monitoring users, programs or devices to maintain the integrity of platforms
    • G06F2221/034—Test or assess a computer or a system

Definitions

  • the present invention relates to the field of securing software execution on an electronic device against attacks, and more particularly to a method for a dynamic activation of countermeasures.
  • Software execution on an electronic device may be subject to various attacks that enable an attacker to modify maliciously the software code execution on the electronic device or to gain knowledge of sensitive data stored on the secure device, such as secret cryptographic keys or banking information.
  • this invention therefore relates to a method for configuring an electronic system for a secure execution of a code comprising a plurality of functions, said electronic system being configured for applying during an execution of a function a security countermeasure configuration among a plurality of security countermeasure configurations, said method being performed by said electronic system comprising a hardware processor, security hardware registers configured for storing start addresses of functions among said plurality of functions and associated security countermeasure configurations to be applied during an execution of said functions, a detection system configured to detect an attack on said electronic system during an execution of a function among said plurality of functions, and comprising:
  • said electronic system comprises further a backup memory, and the start address of said first function and said selected security countermeasure configuration stored in said security hardware register are copied from said security hardware register to said backup memory after said detection of an attack and, at boot of the electronic system, the start addresses and associated security countermeasure configurations stored in said backup memory are copied from said backup memory to said security hardware registers.
  • this invention relates to a method for executing a code comprising a plurality of functions by an electronic system configured for a secure execution of said code according to the method according to the first aspect and for applying during an execution of a function a security countermeasure configuration among a plurality of security countermeasure configurations and comprising a hardware processor and security hardware registers storing, for at least one function among said plurality of functions, a function start address and an associated security countermeasure configuration to be applied during an execution of said at least one function, said method being performed by said electronic system and comprising, when code execution is switched from a first function to a second function:
  • Such a method enables to efficiently protect parts of the code by activating during their execution the countermeasures needed to protect it from the kind of attacks that have already been detected during a previous execution of the code.
  • Applying said predetermined security countermeasure configuration may comprise deactivating all activated countermeasures.
  • said electronic system comprises a processor secure status hardware register (psr_sec) storing a start address of a function being executed and a current security countermeasure configuration, and :
  • psr_sec processor secure status hardware register
  • the method according to the second aspect may comprise : when code execution is switched from a first function to a second function, saving the content of the processor secure status hardware register storing the start address of the first function being executed and updating the processor secure status hardware register with the start address of the second function, and at the end of the execution of the second function and when execution goes back to the first function, reloading the saved content.
  • the step of determining if one of the security hardware registers stores a second function start address and/or the step of saving the content and of reloading the saved content may be performed by a dedicated hardware circuit.
  • this invention relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for performing the steps of the methods according to the first and second aspect of the invention when said product is run on the computer.
  • this invention relates to an electronic system comprising a hardware processor, security hardware registers and a detection system configured for performing the steps of the methods according to the first and second aspect of the invention.
  • one or more embodiments comprise the features hereinafter fully described and particularly pointed out in the claims.
  • the invention relates to a method for configuring an electronic system 1 for a secure execution of a code comprising a plurality of functions.
  • the electronic system is able to apply, during the execution of a function, a security countermeasure configuration among a plurality of security countermeasure configurations.
  • Each security countermeasure configuration is defined by one or more countermeasures whose activation protects the electronic system against one or more kinds if attacks.
  • Such countermeasures may comprise timing de-synchronization as clock jitter, power smoothing, activating code anti rerouting mechanism, and memory access redundancy.
  • Such an electronic system comprises, as depicted on Figure 1 , a hardware processor 101 for the execution of the code to be protected, and at least one memory 102, such as a Non Volatile memory, a RAM memory and/or a ROM memory in which the code is stored.
  • the electronic system may also comprise a backup memory 105 such a Non Volatile memory, a One-Time Programmable memory, a hard disk drive...
  • Such an electronic system may for example be a tamperproof smartcard or computer.
  • the main idea of the invention is to activate countermeasures during the execution of functions that have undergone attacks during a previous execution.
  • attacks are detected during operation of the electronic system.
  • the electronic system comprises a detection system 103 configured to detect an attack on the electronic system during an execution of a function among the plurality of functions of the code to be protected.
  • countermeasures to be activated for the next executions of the function are defined.
  • It defines a security countermeasure configuration associated to the function which was running when the attack occurred.
  • the electronic system comprises security hardware registers 104 configured for storing start addresses of functions among the plurality of functions of the code and associated security countermeasure configurations to be applied during an execution of these functions.
  • such security hardware registers may be named break i _ sec with i an integer number.
  • the electronic system checks at the beginning of the execution of a function if its start address is stored in any of the security hardware registers break i _ sec. If a function start address is found, the associated configuration is applied by activating the required countermeasures, so that these countermeasures remain active all along the execution of the function associated therewith.
  • a first step S1 the detection system of the electronic system detects an attack on said electronic system during an execution of a first function. This step may be performed continuously during operation of the electronic system until an attack is detected.
  • a security countermeasure configuration to be applied during an execution of the first function.
  • a security countermeasure configuration preferably comprises one or more countermeasures against the attack detected at the first step, such that this countermeasure configuration, when applied, triggers the countermeasures required to protect the electronic system against another execution of the detected attack.
  • a third step S3 the electronic system stores in a security hardware register break i _ sec the first function start address and the selected security countermeasure configuration to be applied during an execution of the first function.
  • a fourth step S4 when the code execution is switched from a first function to a second function, the electronic system determines if one of the security hardware registers break i _ sec stores the second function start address.
  • Such a step may be performed by a dedicated hardware circuit.
  • step S41 When one of the security hardware registers break i _ sec stores the second function start address in a step S41, the electronic system applies the stored security countermeasure configuration before executing the second function. By doing so, the execution of the second function is effectively protected by the activated countermeasures against the kind of attacks it has undergone during a previous execution.
  • the electronic system may apply a predetermined security countermeasure configuration before executing the second function.
  • Such a predetermined security countermeasure configuration may just indicate that no countermeasure at all is needed.
  • applying the predetermined security countermeasure configuration may comprise deactivating all activated countermeasures in order to speed up the execution of the second function.
  • the fourth step described above may be performed repeatedly each time a new function is called, in order to adapt the countermeasures configuration to next function to be executed.
  • the electronic system may at the same time perform on one hand the three first steps S1 to S3 in order to continuously detect new attacks and adapt the security countermeasure configurations stored in the security hardware registers; and on the other hand perform the fourth step S4 at each function switch in order adapt the applied countermeasures to the function being executed.
  • the electronic system may comprise a backup memory 105, such as a NVM or One-Time Programmable memory, and after an attack is detected during the execution of a first function, the start address of said first function and said selected security countermeasure configuration stored in said security hardware register are copied from said security hardware register to said backup memory.
  • the start addresses and associated security countermeasure configurations stored in said backup memory are copied from said backup memory to said security hardware registers.
  • it may comprise a processor secure status hardware register psr_sec configured for storing the start address of the function being executed and the current security countermeasure configuration being applied.
  • a start address of the first function and the current security countermeasure configuration may be stored, at the beginning of an execution of a first function, in the processor secure status hardware register psr_sec.
  • the fourth step S4 when the code execution is switched from a first function to a second function, the content of the processor secure status hardware register psr_sec relating to the first function may be saved, for example in RAM or in dedicated hardware registers, and the processor secure status hardware register psr_sec may be updated with the start address of the second function.
  • determining if one of the security hardware registers break i _ sec stores the second function start address may comprise comparing the second function start address stored in the processor secure status hardware register psr_sec to the function start addresses stored in the security hardware registers break i _ sec.
  • Such a comparing step may be performed by a dedicated hardware circuit, for example by hardware comparators between each security hardware registers break i _ sec and the processor secure status hardware register psr_sec.
  • applying a security countermeasure configuration associated to the second function start address before executing said second function may then comprise activating the security countermeasures which are required in the security countermeasure configuration associated to the second function start address and which are inactivated in the current security countermeasure configuration that has been applied during the execution of the first function.
  • execution goes back to the first function and the previous state of the processor secure status hardware register psr_sec, which was saved when the execution switched to the second function, may be reloaded, for example from RAM or from dedicated hardware registers. Such a step may be performed by a dedicated hardware circuit.
  • FIG. 3 An example of configuration of the electronic system is shown on Figure 3 which shows the operations performed during the detection of an attack during the execution of a function B called by a function A.
  • function A is executed.
  • the processor secure status hardware register psr_sec stores the start address of function A 0x200 and a security countermeasure configuration 0x0 indicating that no countermeasure is required.
  • function B is called.
  • the processor secure status hardware register psr_sec is updated with the start address of function B 0x2000.
  • the detection of an attack raises a security alarm which leads to writing the start address of function B 0x2000 in one of the security hardware registers break 1 _ sec.
  • the electronic system determines that three countermeasures are required to prevent such an attack and therefore associates to the start address of function B 0x2000 a security countermeasure configuration 0x3 requiring the activation of these three countermeasures.
  • the content of the security hardware register break 1 _ sec may be copied to the backup memory in order to be able to restore it at reboot.
  • FIG. 4 shows an initial state of the electronic system in which a first function A is being executed and calls a second function B. It is supposed that three security hardware registers break 1 _ sec, break 2 _ sec and break N _ sec store the start addresses of functions B (0x2000), D (0x4000) and F (0x6000) and the associated security countermeasure configurations - which are not shown on Figure 4 - but the start address of function A 0x200 is not stored in any of the security hardware registers. As a result, function A is being executed without any countermeasure activated.
  • the processor secure status hardware register psr_sec stores the start address (A@ or 0x200) of function A, and the security countermeasure configuration 0x0 indicating that no countermeasure is required in this configuration.
  • function B is called.
  • the start address B@ 0x2000 of function B is copied to the processor secure status hardware register psr_sec and this start address is looked for in the security hardware registers.
  • the security hardware register break 1 _ sec stores the start address B@ 0x2000 associated with the security countermeasure configuration 0x3 requiring the activation of three countermeasures.
  • this security countermeasure configuration 0x3 is different than the previous one 0x0 applied to the execution of function A, the three countermeasures required in the security countermeasure configuration 0x3 and kept inactivated during the execution of function A are activated by a call to the activation function at the address 0x1100.
  • the processor secure status hardware register psr_sec now stores the start address of function B@ 0x2000 and the associated security countermeasure configuration 0x3.
  • Figure 4 and 5 also show what happens when the execution of function B has ended and execution of function A resumes.
  • the processor secure status hardware register psr_sec still stores the start address of function B@ 0x2000 and the associated security countermeasure configuration 0x3.
  • Function A start address 0x200 is not found in the security hardware registers. Therefore the predetermined security configuration 0x0 is applied, which deactivates the three countermeasures activated during the execution of function B, by a call to the deactivation function at the address 0x1100.
  • the processor secure status hardware register psr_sec now stores again the start address of function A@ 0x200 and the associated security countermeasure configuration 0x0.
  • the invention relates to a computer program product directly loadable into the memory of at least one computer, comprising software code instructions for performing, when said product is run on the computer, the steps of the methods described here before.
  • the method and the computer program according to the second and third aspects of the invention may be configured for performing or may comprise any other features described here before.
  • the electronic system and method presented here therefore enable to efficiently trigger the execution of additional countermeasures on specific parts of the code to be protected, with almost no footprint on this code and with a limited impact on the execution time since no countermeasure is activated during the execution of functions for which no protection is needed.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Software Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Computer Hardware Design (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Storage Device Security (AREA)
EP19306680.0A 2019-12-18 2019-12-18 Système électronique et procédés pour une activation dynamique de contre-mesures Withdrawn EP3839779A1 (fr)

Priority Applications (4)

Application Number Priority Date Filing Date Title
EP19306680.0A EP3839779A1 (fr) 2019-12-18 2019-12-18 Système électronique et procédés pour une activation dynamique de contre-mesures
EP20848856.9A EP4078418A1 (fr) 2019-12-18 2020-12-18 Système électronique et procédés d'activation dynamique de contre-mesures
US17/783,688 US20230080096A1 (en) 2019-12-18 2020-12-18 Electronic system and methods for dynamic activation of countermeasures
PCT/FR2020/052559 WO2021123684A1 (fr) 2019-12-18 2020-12-18 Système électronique et procédés d'activation dynamique de contre-mesures

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
EP19306680.0A EP3839779A1 (fr) 2019-12-18 2019-12-18 Système électronique et procédés pour une activation dynamique de contre-mesures

Publications (1)

Publication Number Publication Date
EP3839779A1 true EP3839779A1 (fr) 2021-06-23

Family

ID=74494940

Family Applications (2)

Application Number Title Priority Date Filing Date
EP19306680.0A Withdrawn EP3839779A1 (fr) 2019-12-18 2019-12-18 Système électronique et procédés pour une activation dynamique de contre-mesures
EP20848856.9A Pending EP4078418A1 (fr) 2019-12-18 2020-12-18 Système électronique et procédés d'activation dynamique de contre-mesures

Family Applications After (1)

Application Number Title Priority Date Filing Date
EP20848856.9A Pending EP4078418A1 (fr) 2019-12-18 2020-12-18 Système électronique et procédés d'activation dynamique de contre-mesures

Country Status (3)

Country Link
US (1) US20230080096A1 (fr)
EP (2) EP3839779A1 (fr)
WO (1) WO2021123684A1 (fr)

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3376423A1 (fr) * 2017-03-14 2018-09-19 Gemalto Sa Contremesures auto-adaptatives
US20180307835A1 (en) * 2017-04-19 2018-10-25 Seagate Technology, Llc Computing system with power variation attack countermeasures
US20190188391A1 (en) * 2017-12-18 2019-06-20 Nuvoton Technology Corporation System and method for coping with fault injection attacks

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP3376423A1 (fr) * 2017-03-14 2018-09-19 Gemalto Sa Contremesures auto-adaptatives
US20180307835A1 (en) * 2017-04-19 2018-10-25 Seagate Technology, Llc Computing system with power variation attack countermeasures
US20190188391A1 (en) * 2017-12-18 2019-06-20 Nuvoton Technology Corporation System and method for coping with fault injection attacks

Also Published As

Publication number Publication date
EP4078418A1 (fr) 2022-10-26
US20230080096A1 (en) 2023-03-16
WO2021123684A1 (fr) 2021-06-24

Similar Documents

Publication Publication Date Title
KR102075372B1 (ko) 안전한 도메인과 덜 안전한 도메인을 갖는 데이터 처리장치에서의 예외처리
US10025923B2 (en) Data processing apparatus and method for protecting secure data and program code from non-secure access when switching between secure and less secure domains
US6925557B2 (en) Method and system for a clean system booting process
US10223527B2 (en) Protecting computer code against ROP attacks
EP3308314B1 (fr) Suivi de l'accès aux données d'état en mode sécurisé
EP3864554B1 (fr) Indicateur de désactivation de transition
US20150220328A1 (en) System for detecting call stack tampering
US20070226478A1 (en) Secure boot from secure non-volatile memory
JP2006522968A (ja) 携帯型データ・キャリアのバーチャル・マシン向けプログラムの制御実行
US20050172305A1 (en) Protecting an operating system kernel from third party drivers
EP3839779A1 (fr) Système électronique et procédés pour une activation dynamique de contre-mesures
WO2020037115A1 (fr) Systèmes et procédés pour repousser des cyberattaques basées sur une pile par randomisation de taille de structure de pile
WO2020095295A1 (fr) Protection contre la programmation orientée retour
CN118734311A (zh) 被配置为执行计算机程序的计算机系统
JP6594213B2 (ja) 制御装置およびプログラム

Legal Events

Date Code Title Description
PUAI Public reference made under article 153(3) epc to a published international application that has entered the european phase

Free format text: ORIGINAL CODE: 0009012

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION HAS BEEN PUBLISHED

AK Designated contracting states

Kind code of ref document: A1

Designated state(s): AL AT BE BG CH CY CZ DE DK EE ES FI FR GB GR HR HU IE IS IT LI LT LU LV MC MK MT NL NO PL PT RO RS SE SI SK SM TR

RAP1 Party data changed (applicant data changed or rights of an application transferred)

Owner name: THALES DIS FRANCE SAS

STAA Information on the status of an ep patent application or granted ep patent

Free format text: STATUS: THE APPLICATION IS DEEMED TO BE WITHDRAWN

18D Application deemed to be withdrawn

Effective date: 20211224